This is a translation for convenience. The German version is legally binding. German version (Deutsche Fassung)
1. Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR; German: DSGVO, Regulation (EU) 2016/679) is: Florian Mahrl, Traklgasse 9/1, 1190 Wien, Austria. Email: florian.mahrl@gmail.com
2. What data we process
We only process data that you give us or that arises when you use the app: • Account: name, email address, sign-in method (email address, Google or Apple), language and settings. • Family: family name, members (first name, age group, date of birth — optional in the web app, in the iOS app when adding a child —, interests) and the role in the account (adult or child, see section 11a). • Planning: wishes, day plans and trips, votes (options, votes and, for votes via link, the optionally typed-in name), calendar entries, ratings, visits (place, date, status), recipes, meal plans, food preferences and — voluntarily — allergies (for suitable meal suggestions in plans, on trips and in the meal planner). • Messages: family, friends, group and direct chats. In group chats, all member families of the group (up to 20) see the family name and the message text. Messages in family, friends, group and direct chats are automatically deleted after 180 days (section 7). • Photos: only what you upload yourself — pinboard and outing recap (for your family; in the web app you can also share an outing photo with connected families or publicly) or community tip (public). Storage location: section 4b; who can see photos: section 6b. • Location: only with your permission (section 6e). • Technical data: push token for notifications, time of your last activity and which features you use (for quotas and to improve the app). This also includes whether you had an area open only briefly or for longer — as a rough level, never as a value in seconds. For each usage event we also store the platform, app version and build number so that we can attribute an error to a specific app version. Content, titles or places are not stored in the process. Publicly shared community posts (title, description, family name, rating) are visible to all users. When an account is deleted, they are anonymized.
3. Legal bases and purposes
• Consent (Art. 6(1)(a) GDPR): AI suggestions, location and live location, device calendar mirror, Reminders mirror of the children’s tasks, Google Calendar, analytics cookies on the web, weekly summary by email. You can withdraw any consent at any time. • Contract (Art. 6(1)(b) GDPR): account, family, planning, chats, subscription processing, confirmation and notification emails. • Legitimate interest (Art. 6(1)(f) GDPR): security, protection against abuse and costs, crash reports of the iOS app, deletion of inactive accounts, the shared place pool from saved plans (section 6d3). Purposes: suggestions for time together, calendar and wish management, votes, friends features, payment processing.
4. Recipients and processors
Your data is not sold. These services receive data from us or directly from your device: (1) Google Firebase / Google Cloud (Google Ireland Ltd. / Google LLC) — hosting, sign-in, database, file storage, backend functions, push messages (FCM) and bot protection (App Check). Storage location EU, see section 4b. Processing on our behalf (data processor). (2) Google Gemini API (generativelanguage.googleapis.com, Google LLC, USA) — AI suggestions, scans and the review of publicly shared photos; without email addresses, with the names of your family members replaced by placeholders (exactly what the AI receives: section 5). For individual requests, Gemini may use Google Search (“grounding”) to check current facts such as opening hours; in that case the same request goes to Google. For tour recommendations (hiking, cycling), the city, approximate coordinates and the type of tour are transmitted; results are cached for 7 days per region. (3) Google Custom Search (Google LLC, USA) — search for events. Place, date and category are transmitted, no profile data. Results are cached for 24 hours. (4) Google Places API (Google LLC, USA) — search and display of places; anonymized search queries. (5) Payment — in the iOS app via Apple (App Store / StoreKit), on the web via Stripe, Inc. (USA). We only receive the subscription ID, status and expiry date; your payment data stays with Apple or Stripe. (6) Google Calendar API — only if you connect your Google Calendar (section 6c). (7) Open-Meteo (open-source weather service) — weather data. Only coordinates are transmitted. (8) Google Firebase Crashlytics (Google LLC, USA) — crash reports of the iOS app (error message, device model, iOS version). Can be switched off in the app’s privacy settings. (9) Google reCAPTCHA Enterprise / Firebase App Check (Google LLC, USA) — only on the web and only with the first AI request after sign-in, to protect the AI endpoints against abuse. Evaluates technical interaction and device data. (10) Google Analytics 4 (Google Ireland Ltd. / Google LLC, USA) — audience measurement on the web, only if you choose “Accept all” in the cookie notice or switch on analytics cookies. IP anonymization is active. The iOS app contains no analytics. (11) Email delivery via Google (Gmail / Google Workspace SMTP, Google LLC) — welcome email, confirmations, notifications by email (if you choose this instead of push) and the weekly summary. Email address, name and the content of the email are transmitted. (12) OpenStreetMap: Nominatim (OpenStreetMap Foundation, United Kingdom) and Overpass — place search, addresses and place data; map tiles on the web (tile.openstreetmap.org). From the browser: search text or coordinates and your IP address. From our server: only place queries without any personal reference. (13) Wikipedia / Wikimedia Commons (Wikimedia Foundation, USA) — photos of places. Our server requests images for place coordinates; your browser or the app loads the images directly from upload.wikimedia.org (Wikimedia sees your IP address in the process). (14) Apple MapKit (Apple Inc., USA) — in the iOS app: map, place search, checking suggestions against real places and the surroundings view (“Look Around”). Apple receives search queries and the coordinates of the map section or — if you allow it — of your location. Apple’s privacy policy applies. (15) Sign in with Google or Apple — only if you choose this method. Google or Apple confirms your identity and transmits your name and email address to us (with Apple, on request, a relay address).
4a. Transfers to third countries (Art. 44 et seq. GDPR)
These recipients are located outside the EU. Basis for each recipient: • Google LLC (USA): Gemini API, Custom Search, Places, Analytics 4, reCAPTCHA / App Check, Crashlytics, Sign in with Google, email delivery — EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). Firebase Auth and FCM are globally distributed with EU failover. • Apple Inc. (USA): StoreKit, MapKit, Sign in with Apple, Siri (only if you use Siri, section 6d2) — EU-U.S. Data Privacy Framework. • Stripe, Inc. (USA): payment on the web — EU-U.S. Data Privacy Framework. • Wikimedia Foundation (USA): only public image data; Wikimedia receives your IP address when the images are loaded. • OpenStreetMap Foundation (United Kingdom): adequacy decision of the European Commission for the United Kingdom. You object to the transfer to the Gemini API by switching off the AI features (section 5, which also explains what this has covered in the web app so far). Analytics only runs with your cookie consent.
4b. Data residency (storage locations)
As of 2 September 2026: Your account, family and planning data are stored and processed in the EU: Firestore database in the Google Cloud multi-region “eur3” (Belgium and the Netherlands, witness region Finland); file uploads (profile pictures, family photos) in a Google Cloud Storage bucket in the EU; backend functions (Cloud Functions) in “europe-west1” (Belgium). Sign-in (Firebase Auth) and push (FCM) are globally distributed with EU failover. Your content (account, family, wishes, plans, chats, photos) does not leave the EU in regular operation. Only the services named in section 4a receive individual data outside the EU — the AI without email addresses and with placeholders instead of the names of your family members (section 5). For questions about data residency: florian.mahrl@gmail.com.
5. AI processing (Google Gemini)
We use the Google Gemini API (endpoint generativelanguage.googleapis.com, Google LLC, USA) for activity suggestions, day plans, trip and meal suggestions, the AI chat, text recognition when scanning calendars, posters and recipes, and the automatic review of publicly shared photos (community tips, outing photos shared publicly in the web app). The suggestions are non-binding; there is no decision with legal effect (Art. 22 GDPR). What the AI receives so that suggestions fit you: city, date and weather; the language your app runs in (so that plans and suggestions come in that language); your location (as coordinates, for suggestions nearby, “Plan from here” and individual searches); number and ages of the children (as an age group or in years); interests; your wishes; free and busy time slots; recipes, food preferences and allergies; details such as dog, stroller or wheelchair, budget, family type and discount cards; places you have visited, rejected or saved. In the iOS app, when planning, the AI also receives the time, title and location of your fixed appointments so that the day fits around them; the AI chat of the web app sees the appointment titles of the next seven days. For suggestions with friends’ families, their family name is included. What the AI does not receive: email addresses, dates of birth (only the age calculated from them) and the descriptions of your appointments. The names of your family members are replaced by placeholders before sending (Person1, Kind1; in the iOS app currently only names of three letters or more). What you write yourselves into wishes or appointment titles is sent as text — names in it are not replaced in every case. Consent: New users are asked once before the first personalized AI request (“Quick question”) — in the iOS app from version 1.0.117, in the web app since October 2026. As long as the answer is pending, AI requests run without personal data — only with place, date, weather and what you type in for the plan. You can also give your consent yourselves in the settings (iOS app: Privacy; web app: Settings → Privacy). Anyone who used the app before this change is deemed to have consented and can switch it off at any time. Switching off: “Plan entirely without AI” (iOS app: privacy settings; web app: Settings → Privacy) applies to your account in the app and on the web: the app then no longer queries the Gemini API with your data — the iOS app plans only with verified places from our pool, the web app shows verified places where they exist, otherwise a notice. Publicly shared photos continue to be reviewed automatically by the server (see above). In addition, the web app has the older switch “Enable AI features” under Settings → AI & Calendar, which only applies to the respective device. The switch “AI without personal data” leaves out personal details (interests, children, names, wishes, outings, appointments): in the web app for all AI requests — for the meal plan, recipes and dietary details are included, for the weekend vote the wishes entered for it; what does not work without your details stays off or comes from templates. In the iOS app it does not yet apply to all features, for example not to the meal planner, trips and editing a plan. Logs: For troubleshooting, we store a sample (5 %) of AI requests together with the response and every failed AI request for 30 days, each truncated to 1,500 characters and with a shortened, hashed identifier (pseudonym) instead of your user ID. We store the costs per request (model, volume, costs, user ID) for 90 days. AI chat: We do not store messages to the AI assistant permanently; the logs above may contain them. A trip in one sentence: If you type or speak a whole sentence for a trip in the iOS app (e.g. “We are driving to Krems today and staying with friends …”), the app first breaks it down on your device — with fixed word rules and, where available, Apple’s on-device language model; the sentence does not leave the device. Only if no destination can be recognised that way is the sentence sent once to the AI (Google Gemini), solely to extract place, day and overnight stay; the app replaces recognised personal names with placeholders beforehand. The suggestions for the trip come from our place pool, without AI.
6. Data security
We use technical and organizational measures: TLS/SSL encryption for all data transfers, Firebase Security Rules for access control, server-side API key management (no keys in the client), Apple StoreKit / Stripe for PCI DSS-compliant payment processing.
6a. Encryption in detail (transparency)
Transport encryption: All browser↔server connections use TLS 1.3 (HTTPS). HSTS is enabled. Network attackers cannot read anything. Encryption at rest: Firestore (our database provider, Google) encrypts all data on disk with AES-256. Firebase Storage (photos, attachments) does the same. Auth tokens are stored securely. Chats: Family chats, group chats (kindergarten, school class, etc.) and 1:1 direct messages are stored in plain text in Firestore. This means: administrators of Weekend Pilot as well as Google infrastructure staff could technically view messages. We do NOT do so outside the following exceptions: (a) investigation of abuse reports by affected users, (b) statutory obligation to provide information (court order, GDPR data subject access request). End-to-end encryption (E2EE): currently being developed for 1:1 direct messages — the feature will be opt-in and can be activated per device. Group chats and family chats are not planned for E2EE in the short term due to the technical complexity (multiple devices, key rotation, group key management). Deleting your own messages: In group chats and 1:1 direct messages you can delete your own messages yourself at any time — the deletion is immediate and final (not just a soft flag). AI communication: No email addresses go to Google Gemini; the names of your family members are replaced by placeholders (what the AI receives: section 5). Appointments: For suggestions, the web app only sends structured free/busy time slots (e.g. “busy 10:00-12:00, free 14:00-18:00”); the iOS app also names the title and location of fixed appointments when planning, the AI chat of the web app the appointment titles — never the description. With “AI without personal data”, no appointments go to the AI in the web app (section 5). Passwords: Are never stored by us — Firebase Auth (Google) hashes and salts them on the server; we have no access to plain-text passwords.
6a2. Photo import and calendar scan (as of 2 August 2026)
Photo import (“We were here”): At your request, the iOS app analyzes your photo library or an album you select in order to recognize places you have visited. This analysis (capture date, location coordinates of the photos) takes place exclusively locally on your device — neither photos nor metadata are transferred to our servers or to third parties in the process. Only what you then expressly select is uploaded: photos you add to an outing recap (visible only to your family, see 6b), or photos you actively share as a community tip (public, with prior automatic moderation). Legal basis: consent (Art. 6(1)(a) GDPR), revocable at any time by withdrawing photo access in the iOS settings. Calendar/poster scan: If you photograph a paper or Excel weekly schedule (or an event poster), this one image is transferred to the Google Gemini API (USA, DPF-certified) for text recognition and is not stored there permanently. You see the recognized appointments in a confirmation list before they are adopted — nothing is written to the calendar without your review. The app points out the AI transfer before every scan.
6b. Family isolation (as of 26 September 2026)
Who sees what — technical guarantees through Firebase Security Rules: According to the Storage Rules, pinboard and outing photos may only be loaded and deleted by members of your family (the Storage Rules check family membership via a Firestore lookup). Photos are displayed via an image link with an access key; anyone who can see this link can open the photo — for photos for the family only your family, for outing photos that you share in the web app with connected families or publicly, also those families or all signed-in users. Calendar events are readable/editable exclusively by your family — friends’ families only see events via activated calendarSharing (no write access). Chats (family, friends, group) are only readable and writable by the families listed in `familyIds` — other auth users cannot view anything. User profiles are not directly readable outside your own family — a separate Cloud Function only provides the display name and avatar (no email, no private fields) for cross-family displays such as DM partner lists. Family documents are only readable by their own members + friends’ families — invite code lookups run via a protected Cloud Function. Featured events (landing page content) can only be written by the admin. These guarantees are enforced at server level, not just in the UI — they also apply to direct API access.
6c. Google Calendar API — precise data use (as of 23 September 2026)
If you choose “Connect Google Calendar” in the settings, access runs through the following data flows — fully documented for the Google verification. What we READ: appointments for the next 90 days from your Google calendars (each can be deselected in the settings): title, description, location, start and end as well as the number of participants — not their names or addresses. We ignore everything else (e.g. attachments, conference links, response status). Birthdays are used separately as an occasion hint in the dashboard. Purpose: to recognize existing fixed points so that the planner does not place suggestions on top of them. What we WRITE: As long as the web app is connected to your Google Calendar, it automatically transfers every appointment you create there in Weekend Pilot — including from plans, votes and suggestions — to your Google Calendar (to the target calendar from the settings, otherwise to your primary calendar), with title, description, location and time. If you change or delete an appointment transferred in this way in Weekend Pilot, we also change or delete it in Google. If you delete an appointment in Weekend Pilot that comes from your Google Calendar, it is also deleted there. “Sync all” in the settings transfers all appointments of your family calendar when you tap it. We do not change or delete any other appointments in your Google Calendar. What we NEVER do: no disclosure of your calendar data to third parties; no sale; no AI training with your appointments (the title, description and location of your Google appointments do not go to Google Gemini; what the AI receives otherwise: section 5); no advertising based on calendar data; no analysis by staff outside the exceptions named in point 6a. Storage location: Your most recently read appointments are cached in your personal Firestore doc under `users/{your-uid}/gcalCache/events` (storage location: see section “Data residency”) so that the planner works offline and across devices. Access: exclusively you yourself (enforced by Firestore Security Rules). Other families see NOTHING of it. Disconnecting: When you click “Disconnect” in the settings, we delete (a) the OAuth token at Google via the revoke endpoint, (b) the local token from your browser, (c) the pull cache in the browser, (d) the Firestore cache `users/{your-uid}/gcalCache/events`. After that, the app no longer reads or writes anything in your Google Calendar; appointments already transferred remain there until you delete them yourself. OAuth scope: We request exclusively `https://www.googleapis.com/auth/calendar.events` (no settings, no sharing/ACL). This scope covers reading and writing appointments — we use it exactly for the reading and transferring described above. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time by disconnecting.
6d. Device calendar of the iOS app (mirror into the family calendar)
The iOS app can mirror appointments from your device calendar into the family calendar so that your family can see when you are busy. This only happens if you expressly switch on this feature in the app (consent, Art. 6(1)(a) GDPR). What is mirrored: title, start, end, all-day flag and location of your appointments from 7 days back to 3 months ahead. Not mirrored: participants, notes, attachments. Who sees it: the members of your family in Weekend Pilot. The entries are marked with your name and cannot be edited in the app. If you have activated “Calendar for friends”, friends’ families also see your family calendar. Switching off: at any time in the app’s settings. When you switch it off, we delete the mirrored entries from the family calendar. From these entries, free and busy time slots go to the AI and, when planning, also the time, title and location of a fixed appointment (section 5), never notes or participants.
6d2. Children’s tasks: widget, Siri and Reminders (iOS app from version 1.0.118)
Widget: The “Tasks” widget shows your children’s tasks on the home and lock screen. For this, the app stores a copy of the open tasks on your device; when the device is locked, the task text is hidden. If you tap “done” in the widget, the app reports the task to our server just as in the app itself — stars are only awarded once a parent confirms. The copy is deleted when you sign out. Siri: If you ask Siri about a child’s tasks or report a task as done, Apple processes the voice input in accordance with Apple’s privacy policy; the answer comes from the app on your device. Reminders (in test versions of the app; for everyone only after our test in a later version): Only if you switch it on in the kids’ corner and iOS allows access does the app create a list “Aufgaben von <first name>” (tasks of <first name>) for each child in Apple’s Reminders and keep it up to date with the tasks. If you tick off a task there, the app reports it as done. The app only reads and changes these lists of its own, no other reminders. The lists are stored on your device and, if you use Reminders with iCloud, in your iCloud; nothing from them goes to our server except the message “done”. Switching off: in the kids’ corner or in the iOS settings (Privacy → Reminders); the lists remain in Reminders until you delete them there. Legal basis: contract (Art. 6(1)(b) GDPR) for the widget and Siri, consent (Art. 6(1)(a) GDPR) for Reminders.
6d3. Places from saved plans (shared place pool)
If you save a plan in the iOS app, the name and coordinate of its stops go into our shared place pool so that other families in the area can find good destinations; they can see these places in the app. From version 1.0.118, the app only reports places that Apple Maps knows, with Apple’s coordinate. The place does not show which family planned it. So that we can recognize whether several families have planned the same place, our server stores, for each place, a shortened, hashed identifier of the reporting families, in an area that neither the app nor other users can read. In the privacy mode “Private”, saved plans do not report any places. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in a suggestion pool made of real, planned places.
6e. Location and visits
Location: The app only uses your location if you allow it in the browser or in iOS — for suggestions near you, weather and distances. The web app asks once on the home page and says what for; after that only when you yourself tap something that needs your location (e.g. “Use current location”). Without permission, we plan with your home town or the city you specify. Live location: Only if you switch on “Share live location” for a specific appointment do we send your position every 60 seconds to the participants of that appointment. This ends automatically after the appointment or immediately when you stop it; the entry is deleted in the process. “I am here” link: If you tap “Share live pin” for an ongoing appointment in the iOS app, we store your current position together with the title and a short message you enter, and create a link. Anyone you send the link to sees the position on a map until the pin expires (after 60 minutes by default); after that it can no longer be accessed. This does not depend on the privacy mode — you decide by sending it. Friend nearby: Only if you switch on “Friend nearby” and your privacy mode allows location matches — in the web app “Smart” or “Open for Friends”, in the iOS app “Nearby matches” or “Open”, with “Custom” if location region is switched on — does the web app send your position to our server every 15 minutes while the home page is open. The server only stores the most recent position in each case; friends’ families who have also switched this on learn that you are nearby (distance, place rounded to about one kilometer). If you have not made a choice, the mode “Basic” applies — your location is then not shared with friends. Position check: Whether the day plan still fits (e.g. the way home) is calculated by the app from your current position on your device; no position goes to our server in the process. In the background, this only happens with the on-the-go companion. On-the-go companion (iOS): Only if you switch it on — via the one-time question (“Should Weekend Pilot let you know …?”) or in the settings — does the iOS app also use your location in the background (permission “Always”). iOS only wakes the app on larger changes of location (about 500 m) and reports stays (visits); no continuous GPS. Whether you are on an outing (at least 45 minutes in one place, more than 100 m and at most 150 km from home, on your free days — weekends, public holidays, school holidays and free weekdays according to your work schedule; places you visit regularly do not count), whether you deviate from a saved day plan and whether you are on your way home is calculated by the app on your device; detected stays remain on the device, and here too no position goes to our server. For the way-home tip and the name of the outing place, the app queries places from our pool in the area; otherwise Apple Maps names the area. The companion gets in touch when you deviate from the plan, with at most one way-home tip per outing, and in the evening with a notification from the device asking where you were — we only store a visit once you confirm the place or enter a different one. Switching off: Settings → “On-the-go companion”; background location stops immediately, and the traces stored on the device are deleted. On the way and “Hey, where are you headed?” (iOS, only with the on-the-go companion): On free days between 6 and 20 h, the app recognizes on your device that you are setting off (at least 3 km from home and moving further away). If it already knows your destination from the calendar or a saved plan, it does not ask (for this it reads today’s appointments once on that day). Otherwise it asks at most once a day with a notification from the device, “Hey, where are you headed?”, and suggests up to three places from our pool in your direction of travel; for this, as with the way-home tip, it queries places in the area. Whether you are on the way and what you answer stays on the device. Once the destination is set, the app gets in touch once with the weather at the destination (forecast from Open-Meteo for the destination’s coordinate, rounded to about one kilometer) and a stop for the way back or an indoor alternative from the pool. “Just out and about” ends the questions for the day. Today on site: For some destinations (e.g. zoos), our server fetches the official programme or feeding page once a day and stores that day’s entries with source and time of retrieval. If such a place is your destination today, the app loads these entries and shows them with a link to the source; we store nothing about you in the process. Outings in the calendar: If you enter an appointment with a location, the iOS app looks up the coordinate on your device via Apple Maps, the web app via OpenStreetMap (Nominatim, through our server; recipient 12), and stores it with the appointment. The app and the browser evaluate the title themselves; for this they load places from our pool around the location or your home town — the title is not sent anywhere for this. If the title names an outing destination or an outing word (e.g. “hike”, “zoo”), we mark the appointment as “outing planned” — if it has no location of its own, together with the matching place from our outing pool. With notifications allowed, our server checks the weather at the destination for such appointments two days before and on the day before and gets in touch if the weather is bad or cold, where possible with an indoor alternative from the pool. This only applies to your own family’s appointments; we do not check mirrored device or Google Calendar appointments, group appointments or scanned daycare schedules. Visits: If you plan an outing in the calendar, we create a visit as a reference (place, date, status “open” or “confirmed”). In the evening of the outing (at the latest the day after), the app asks whether you were there. The iOS app also checks on the device whether it was close to a planned stop on the day of the outing and — with photo access — whether your photos from that day were taken there; for this it only remembers the matches on the device (stop and day, for 14 days), no movement profile. If this is the case, it records the visit itself as confirmed and shows this with an option to correct it. With location permission, the web app also recognizes visits to known places if you stay there for longer than 20 minutes (place and date are stored, no coordinates; can be switched off in the settings under “Detect visits automatically”). Visits serve the recap and suggestions such as “not been there for a long time”. The photo matching (“We were here”) runs only on your device (section 6a2).
6f. Planning with friends — invitation link (as of 5 September 2026)
You can invite a friends’ family via a link to plan together. The invited family does not need an account for this. What we store: from the inviting family, the first name or family name of the inviting person, the period, interests and the selected wishes as plain text, as well as the place of residence roughly rounded (to about one kilometer, never an address). From the guests only what they enter themselves: name, ideas they tapped or added themselves, interests, time slots, preferred day, optionally the place of residence (also rounded), number and ages of the children, the answer to a settled plan (“Works” / “Not this time”) and — voluntarily — an email address. The email address serves only this one invitation: the guest receives the settled plan by email when you settle on it. We only count views of the invitation page with a hashed IP address (protection against abuse and costs), without any personal reference. Who sees it: the members of the inviting family in the app and every person who has the link — in the browser, with the first names of those who have already answered. Therefore, only pass the link on to families you want to plan with. Storage period: The invitation expires three days after the selected period (without a period, after 30 days) and is then automatically deleted together with the answers and email addresses. If you delete your account, your invitations are deleted; answers you gave as a guest with an account are anonymized. Both sides are included in the data export. Legal basis: contract or pre-contractual steps (Art. 6(1)(b) GDPR) for the invitation; consent (Art. 6(1)(a) GDPR) for the voluntary email notification of the guests.
7. Storage period and deletion
• Account and family data: as long as your account exists. You can delete your account in the settings; we then immediately delete your account, profile, push token, direct messages, invitations and usage data. If you are the only member of your family, we delete the family with all its content (wishes, plans, calendar, chats, photos). If there are other members, the shared content remains available to them, but everywhere without your name, your picture and your identifier (“Deleted user”), including in day plans, calendar entries, polls and comments; your votes and reactions are removed, your own drafts, plan suggestions and share links are deleted, and if the family belonged to you, it passes to another member. If your name itself appears in a text (for example in the title “Anna’s birthday”), it remains there. Community posts and messages in group chats remain without your name so that discussions remain understandable. • Leaving a family or group: what you have shared there remains visible without your name and your picture (“Former member”); your votes continue to count. You leave the family in the settings, in the app and on the web. If you were the last member of the family (for example because you join another family), it stays stored with its content for 30 more days, visible to no one; during this time only you can return with the old invite code, after that we delete it completely (wishes, plans, calendar, chats, photos). If you delete your account before then, we delete it immediately as well. • Inactive accounts: If you are the only member of your family and have no ongoing subscription, we email you after 150 days without activity; if you do not respond within the following 30 days, we delete the account — so no earlier than after 180 days. We delete accounts with an obviously invalid email address after 14 days without activity. We do not automatically delete accounts in families with several members, with an ongoing subscription, in the trial period, or child accounts. • Chat messages: in family, friends, group and direct chats 180 days, then automatic deletion. You can delete your own messages yourself at any time. • Friends invitations: until three days after the selected period, then automatically deleted together with the answers and guest email addresses (section 6f). • AI chat: is not stored permanently (only in the AI logs, 30 days). • AI logs: 5 % sample and failed requests 30 days; costs per AI request 90 days. • Live location: until the end of the appointment or until you stop it. • Google Calendar cache: until you disconnect (section 6c). Device calendar mirror: until you switch off the feature (section 6d). • Payment data: at Apple or Stripe according to their statutory retention periods; we keep the subscription ID and status until the account is deleted. After a purchase on the web, we send you a confirmation email (plan, price, term, cancellation, your consent to the immediate start) and record until account deletion that it was sent.
8. Cookies and analytics (web)
Necessary (always): sign-in, your cookie choice, the language setting and the web app’s settings and caches in your browser (e.g. design, notices already seen, offline data); after sign-in, Google reCAPTCHA to protect the AI features (section 4). Functional: No functional service is currently integrated. Analytics (only with your consent): Google Analytics 4 with IP anonymization (cookies _ga and _ga_…). We do not set any marketing cookies. If you pay on the web, you switch to Stripe’s payment page; Stripe sets its own cookies there for fraud detection. The iOS app uses no cookies and no analytics. You can change your choice at any time under Cookie Settings.
8a. Own advertising and product notices
In the free plan, Weekend Pilot shows notices about its own premium features and offers (so-called “house ads”). No usage data is transmitted to third parties in the process. These are exclusively internal product notices. Personal data is not passed on to advertising partners — external advertising networks (Google AdSense, Ezoic) are not used.
9. Payment data
Credit card and bank data are processed exclusively by Apple StoreKit (iOS app) or Stripe (web app) and are never stored on our servers. We only receive a customer/subscription ID, the subscription status and the expiry date from Apple/Stripe.
10. Your rights under the GDPR
You have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of your consent (Art. 7(3)). You delete your account yourself in the settings: on the web under “Delete account”, in the app with “Permanently delete my account & data” (from version 1.0.116 under “Data & account”). Please send all other requests to florian.mahrl@gmail.com. We respond within 30 days.
11. Data of minors
Weekend Pilot is an app for families: parents create the account, and children take part through the family — in kids mode on a parent’s device (without an account of their own) or with a child account via the parents’ invitation. Only persons aged 16 or over create an account of their own. Children under 16 only use an account of their own via a child invitation from their parents (link or child code, see section 11a); insofar as we rely on consent for this, the parents give it (Art. 8 GDPR; in Austria, from the age of 14 the child can also give it, § 4(4) DSG). When signing up in the web app or the iOS app — also with Google or Apple — our server stores with the account that the terms and the privacy policy were accepted, whether the person confirmed themselves to be at least 16 or came via a child invitation from their parents, plus the time and platform. For child accounts, the time at which an adult generated the child code and the inviting family are added. Children as family members without an account of their own: Parents can add children to the family — first name, age group (e.g. toddler, school child, teenager), date of birth (optional in the web app, in the iOS app when adding the child), interests. When adding a child, you confirm the entry as a person with parental responsibility; we record the time of this confirmation. The purpose is age-appropriate suggestions and birthday reminders. We do not sell this data and do not use it for advertising; the age (as an age group or in years) and the interests go to the AI (section 5), never the name or date of birth. You can edit or delete the data at any time.
11a. Children’s accounts (since 6 August 2026)
How a child account is created: A parent generates a child invitation code in the app. If the child signs in with this code on their own device, their account permanently receives the role “child”. The role depends on the code, not on a statement by the child, and only an adult of the family can change it. The invitation by the parents constitutes the consent under Art. 8 GDPR. What a child account can see and do: see the family calendar, wishes, plans, votes, recipes and meal plan; create their own wishes, votes, photos and posts; write in the family, group and direct chat — the same rules apply here as for adults, please accompany this. What a child account cannot do: see invitation codes, rename the family or manage members, change or delete other people’s entries (recipes, meal plan, day plans, shopping list, pinboard), change their own role. Data of a child account: name, email address or sign-in method, interests, wishes, messages; location only with permission. As with everyone, no names, email addresses or dates of birth go to the AI, only the details from section 5. Parents can remove the child from the family; the account itself is deleted via the settings. Questions about children’s accounts: florian.mahrl@gmail.com.
12. Right to lodge a complaint
You have the right to lodge a complaint with the competent supervisory authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Wien, dsb@dsb.gv.at, www.dsb.gv.at.
Contact
If you have any questions about data protection, you can contact us:
As of 14 October 2026